Bridge device isolation

Hi all,

I'm trying to use a new router here (GL-INET MT6000). I flashed 23.05.3 onto it without issues (sysupgrade image). The older router is a Archer C7 V2 on OpenWrt 22.03.5 which works fine.

The basic things work fine. It has internet and access for LAN clients works.

What I have on the old router and want likewise on the new one is a separate subnet for my phones (not talking smart phones, I mean handhelds). I use a VoIP software on the router and the phones connect to it.

The phones shouldn't be able to connect to the internet or the normal LAN users. So I have two Ethernet ports on the router where the phones connect. I configured this already, adding a bridge device with VLAN 3 and IP 172.31.255.129/29. The zone is called voip and DHCP is working. The zone is set to allow input and output but reject forwarding.

But for some reason I can ping the normal LAN subnet from the phones' Ethernet port and vice versa.

So right now I'm connected via WLAN and my laptop received 192.168.1.152. But I can still ping the IP one the router that is meant for the phones only:

ping 172.31.255.129
PING 172.31.255.129 (172.31.255.129) 56(84) bytes of data.
64 bytes from 172.31.255.129: icmp_seq=1 ttl=64 time=6.35 ms
^C
--- 172.31.255.129 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 6.351/6.351/6.351/0.000 ms

It doesn't really make sense to me, because I changed br-lan to use VLAN 99 (untagged) and the br-voip has VLAN 3 (untagged). And they have different zones (voip and lan) and in the zone rules forwarding is set to REJECT.

Anybody got any idea? Thanks for reading!

Network config:

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd58:c38a:xxxx::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan2'

config device
	option name 'lan1'
	option macaddr '94:83:c4:xx:xx:xx'

config device
	option name 'lan2'
	option macaddr '94:83:c4:xx:xx:xx'

config device
	option name 'lan3'
	option macaddr '94:83:c4:xx:xx:xx'

config device
	option name 'lan4'
	option macaddr '94:83:c4:xx:xx:xx'

config device
	option name 'lan5'
	option macaddr '94:83:c4:xx:xx:xx'

config interface 'lan'
	option device 'br-lan.99'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '64'

config device
	option name 'eth1'
	option macaddr '94:83:c4:xx:xx:xx'

config interface 'wan'
	option device 'eth1'
	option proto 'pppoe'
	option username 'username'
	option password 'pass'

config interface 'wan6'
	option device 'eth1'
	option proto 'dhcpv6'

config device
	option type 'bridge'
	option name 'br-voip'
	list ports 'lan4'
	list ports 'lan5'

config bridge-vlan
	option device 'br-voip'
	option vlan '3'
	list ports 'lan4:u*'
	list ports 'lan5:u*'

config interface 'voip'
	option proto 'static'
	option device 'br-voip.3'
	option ipaddr '172.31.255.129'
	option netmask '255.255.255.248'

config interface 'modem'
	option device 'eth1'
	option proto 'static'
	option ipaddr '10.0.0.6'
	option netmask '255.255.255.252'

config bridge-vlan
	option device 'br-lan'
	option vlan '99'
	list ports 'lan2:u*'

Firewall config:


config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	option masq_dest '!modem'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'voip'
	list network 'voip'
	option input 'ACCEPT'
	option forward 'REJECT'
	option output 'ACCEPT'

config rule
	option name 'Allow-SSH'
	option src 'wan'
	option dest_port 'xxx'
	option proto 'tcp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DTAG-RTP'
	option src 'wan'
	option src_ip '217.0.0.0/16'
	option dest_port '9984:10015'
	option proto 'udp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'REJECT-LAN-TO-DTAG-SIP'
	option src 'lan'
	option dest_ip '217.0.0.0/16'
	option dest_port '5060:5061'
	option proto 'tcpudp'
	option family 'ipv4'
	option target 'REJECT'

OK, I think I'm wrong about this. I connected the old router again and I'm also able to ping the 172.31.255.129 IP on the router from normal LAN Wifi. But I can't ping the clients in the voip zone. Didn't check yet but I'm guessing vice versa it's the same.

Sorry for the noise :slight_smile:

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.